Google Patches Chrome Zero-Day CVE-2026-125350 Amid Active Attacks

Key points

• Google patched CVE-2026-125350, a use-after-free bug in Chrome's V8 engine and XML component.
• The vulnerability is being exploited in real-world attacks by unknown actors.
• The fix is part of a Chrome update covering nine security flaws.
• This is the eighth Chrome zero-day exploited during 2026.

Google has released a Chrome security update that resolves CVE-2026-125350, a use-after-free weakness involving the V8 JavaScript engine and an XML component. According to the vendor, the defect was reported and fixes are now available. The flaw is already being used in live attacks by parties that have not been identified.

The patch is not an isolated fix: it sits within a larger Chrome release that addresses nine vulnerabilities. Security watchers are treating CVE-2026-125350 as especially urgent because it is the eighth Chrome zero-day confirmed as exploited in 2026. That pattern suggests browser flaws remain a favored route for attackers seeking initial access.

For K-12 and government environments, Chrome is often the default browser on student, teacher, and administrative devices. A memory-safety bug such as a use-after-free can be dangerous because it may allow an attacker to corrupt memory and potentially chain the flaw into broader compromise. Even without public exploit details, the confirmed in-the-wild use raises the risk for unpatched endpoints.

IT teams should verify which Chrome builds are running across managed fleets and confirm that the CVE-2026-125350 fix is installed. Because Chrome frequently runs for long periods, a patch is not effective until the browser restarts. Watch for updated vendor guidance, any change in exploitation reports, and follow-on advisories tied to the other eight flaws in the same release.

What to do now

1. Inventory Chrome versions across all managed endpoints and confirm the build containing the CVE-2026-125350 fix.
2. Push the update through browser management tools and force a Chrome restart so the patch actually takes effect.
3. Prioritize high-risk users such as administrators, finance staff, and remote workers, plus devices with untrusted extensions.
4. Enable automatic Chrome updates and configure restart reminders for users who routinely defer them.
5. Review proxy, DNS, and EDR logs for signs of exploitation attempts involving Chrome, V8, or XML components; escalate anomalies.
6. Restrict unmanaged browser use and unsupported Chrome builds on district devices until compliance is verified.
7. Re-scan within 48 hours to confirm patch coverage and track Google Chrome release notes for follow-up advisories.

CVE references

• CVE-2026-125350

Original source

Security Affairs